Supplier data collection: what to ask, when to ask, and what to do with what comes back

The calculation side of CBAM is almost trivial once you have the inputs. The hard part — the part that eats the timeline — is getting installation-level emissions data out of overseas suppliers, many of whom have never been asked. This is the guide we wish every UK SME had in front of them a year before they needed it.

Why supplier data matters more than the calculation

Both CBAM regimes let you fall back on default values published by the authorities. Default values are always higher than actual verified data — they're deliberately conservative. For a £75,000-a-year steel importer, the gap between default and actual can easily be a five-figure annual difference in the charge.

Supplier data is where the money lives. It's also where the risk lives — bad data survives verification about as well as it survives an HMRC review. Both regimes are moving toward continuous monitoring and evidence retention, not one-off numbers.

What to actually ask for

A CBAM-usable data set from a supplier has four parts. Ask for all four; the incomplete ones are the useful early signals.

1. Tonnes CO₂e per tonne of product, at the installation level (not company-average, not country-average).
2. The calculation methodology — ideally aligned to the EU CBAM Monitoring & Reporting Regulation, but at minimum stating the boundary (Scope 1 + electricity Scope 2 for most products).
3. Supporting evidence — the underlying activity data (energy consumption, fuel mix) they used to derive the figure.
4. A verification statement, if they have one, from an accredited third party.

The one-page template

Keep the initial request to one page. Anything longer becomes a procurement negotiation. Include: what you're asking for, why (customer/regulatory), which products/HS codes, the deadline, and who to reply to. Add a link to the CBAM guidance if they want context. That's it.

When to ask

The rule of thumb: send the first request at least six months before your reporting deadline. For UK importers that's November 2027 latest — and realistically sooner, given that responses tend to trail by weeks or months. For anyone exporting to the EU, the definitive phase is already live; your customers are already asking, so your suppliers should be asked this quarter if you haven't already.

What to do with what comes back

Responses fall into four buckets. Each has a different next step:

• Complete and verified. Perfect — store the data, tag the supporting evidence, and use actual values.
• Complete but unverified. Usable for the EU definitive phase and UK CBAM in most cases, but plan for verification. Coordinate a verifier before your reporting deadline.
• "We're working on it." The most common response in 2026–27. Fall back to default values for this reporting period, set a follow-up date, and re-ask.
• No reply. Two follow-ups, then default values. Note this in your methodology documentation — auditors want to see the trail of asks, not just the final number used.

Common mistakes

1. Asking too late. If the first email goes in April 2028 for a May 2028 return, you're on defaults regardless of what the supplier eventually sends.
2. Asking without context. A cold email asking for "your CBAM data" gets ignored. A short email explaining the reporting deadline, the products you buy from them, and what happens if they don't reply gets responses.
3. Storing responses in email. Every response, every follow-up, every methodology note needs to be in one system that survives your next audit. A shared drive with a naming convention beats nothing; a proper supplier portal beats the shared drive.
4. Ignoring the "working on it" suppliers. Those are the highest-value follow-up conversations of 2027 — many of them will have real data within six months, and you want to know when.